Other Activities - Revision history

Antoniok at 13:22, 30 August 2017

2017-08-30T13:22:20Z

← Older revision		Revision as of 15:22, 30 August 2017
Line 105:		Line 105:
	The report describes a privacy risk management framework for federal information systems. The framework provides the basis for establishing a common vocabulary to facilitate better understanding of - and communication about - privacy risks and the effective implementation of privacy principles in federal information systems.		The report describes a privacy risk management framework for federal information systems. The framework provides the basis for establishing a common vocabulary to facilitate better understanding of - and communication about - privacy risks and the effective implementation of privacy principles in federal information systems.

	~~Comments are expected by<span style="line-height~~: ~~1.6;">~~ ~~July 13~~, ~~2015 at 5~~:~~00pm~~.~~</span>~~		A subsequent version was published in January 2017: NISTIR 8062, An Introduction to Privacy Engineering and Risk Management in Federal Systems

			This document provides an introduction to the concepts of privacy engineering and risk management for federal systems. These concepts establish the basis for a common vocabulary to facilitate better understanding and communication of privacy risk within federal systems, and the effective implementation of privacy principles. This publication introduces two key components to support the application of privacy engineering and risk management: privacy engineering objectives and a privacy risk model.

	\|-		\|-
	\| URL		\| URL
	\| ~~See 8062 dated May 28: [http:~~//csrc.nist.gov/publications/PubsDrafts.html http://csrc.nist.gov/publications/PubsDrafts.html] and [http://www.nist.gov/itl/201506_privacy_framework.cfm http://www.nist.gov/itl/201506_privacy_framework.cfm]		\| <br/>
	\|-		\|-
	\| Document		\| Document
Line 115:		Line 117:
	Draft document: [http://csrc.nist.gov/publications/drafts/nistir-8062/nistir_8062_draft.pdf http://csrc.nist.gov/publications/drafts/nistir-8062/nistir_8062_draft.pdf]		Draft document: [http://csrc.nist.gov/publications/drafts/nistir-8062/nistir_8062_draft.pdf http://csrc.nist.gov/publications/drafts/nistir-8062/nistir_8062_draft.pdf]

	~~Comment matrix form~~: [http://~~csrc~~.nist.gov/~~publications~~/~~drafts/nistir-8062/nistir_8062_draft_comment_matrix.xls http:~~//~~csrc~~.~~nist~~.~~gov/publications/drafts/nistir-~~8062~~/nistir_8062_draft_comment_matrix~~.~~xls]~~		FInal version: http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf

	\|-		\|-
Line 124:		Line 126:
	*defines 3 privacy engineering objectives (predictability, manageability, dissociability)		*defines 3 privacy engineering objectives (predictability, manageability, dissociability)
	*includes an impact factor which focuses on organisational aspects (e.g. reputation). Impact on citizen (e.g. stigmatization) are not included in the privacy risk equation (likelihood x impact) but they have an influence on the organisational impact		*includes an impact factor which focuses on organisational aspects (e.g. reputation). Impact on citizen (e.g. stigmatization) are not included in the privacy risk equation (likelihood x impact) but they have an influence on the organisational impact
			*The work from NIST is integrated in ISO/IEC 27550 Privacy engineering

	\|}		\|}

Antoniok at 13:12, 30 August 2017

2017-08-30T13:12:37Z

← Older revision		Revision as of 15:12, 30 August 2017
Line 153:		Line 153:

	{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"		{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"
			\|-
			\| June 05 2017
			\| NIST workshop: Privacy Risk Assessment: A Prerequisite for Privacy Risk Management
			\| https://www.nist.gov/news-events/events/2017/06/privacy-risk-assessment-prerequisite-privacy-risk-management<br/>
	\|-		\|-
	\| May 9 2017		\| May 9 2017
Line 158:		Line 162:
	EIC OASIS Privacy Engineering Workshop		EIC OASIS Privacy Engineering Workshop

	\| https://www.kuppingercole.com/events/eic2017-oasis<br/>		\| <font color="#333333">[https://www.kuppingercole.com/events/eic2017-oasis https://www.kuppingercole.com/events/eic2017-oasis]<br/></font>
	\|-		\|-
	\| Sept 9 2016		\| Sept 9 2016

Antoniok at 13:09, 30 August 2017

2017-08-30T13:09:36Z

← Older revision		Revision as of 15:09, 30 August 2017
Line 153:		Line 153:

	{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"		{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"
			\|-
			\| May 9 2017
			\|
			EIC OASIS Privacy Engineering Workshop

			\| https://www.kuppingercole.com/events/eic2017-oasis<br/>
	\|-		\|-
	\| Sept 9 2016		\| Sept 9 2016
	\| 3rd IPEN workshop, Frankfort		\| 3rd IPEN workshop, Frankfort
	\| https://secure.edps.europa.eu/EDPSWEB/edps/site/mySite/IPEN_Workshop_2016<br/>		\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/site/mySite/IPEN_Workshop_2016 https://secure.edps.europa.eu/EDPSWEB/edps/site/mySite/IPEN_Workshop_2016]<br/></font>
	\|-		\|-
	\| Sept 7-8 2016		\| Sept 7-8 2016

Antoniok at 22:27, 10 September 2016

2016-09-10T22:27:37Z

← Older revision		Revision as of 00:27, 11 September 2016
Line 153:		Line 153:

	{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"		{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"
			\|-
			\| Sept 9 2016
			\| 3rd IPEN workshop, Frankfort
			\| https://secure.edps.europa.eu/EDPSWEB/edps/site/mySite/IPEN_Workshop_2016<br/>
	\|-		\|-
	\| Sept 7-8 2016		\| Sept 7-8 2016
	\| 4th Annual Privacy Forum, Fra		\| 4th Annual Privacy Forum, Fra
	\| http://privacyforum.eu/<br/>		\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]<br/></font>
	\|-		\|-
	\| May 2016		\| May 2016

Antoniok at 22:25, 10 September 2016

2016-09-10T22:25:16Z

← Older revision		Revision as of 00:25, 11 September 2016
Line 152:		Line 152:
	== <span style="font-size:larger;">Events</span> ==		== <span style="font-size:larger;">Events</span> ==

	{\| border="1" cellspacing="1" cellpadding="1" style="width: 900px;"		{\| border="1" cellspacing="1" cellpadding="1" style="width:900px;"
			\|-
			\| Sept 7-8 2016
			\| 4th Annual Privacy Forum, Fra
			\| http://privacyforum.eu/<br/>
	\|-		\|-
	\| May 2016		\| May 2016
	\| IEEE International Workshop on Privacy Engineering		\| IEEE International Workshop on Privacy Engineering
	\| [http://ieee-security.org/TC/SPW2016/IWPE/program.html http://ieee-security.org/TC/SPW2016/IWPE/program.html]<br/>		\| <font color="#333333">[http://ieee-security.org/TC/SPW2016/IWPE/program.html http://ieee-security.org/TC/SPW2016/IWPE/program.html]<br/></font>
	\|-		\|-
	\| January 27-29 2016		\| January 27-29 2016
	\| 9th International conference, Computer Privacy & Data Protection conference, Brussels		\| 9th International conference, Computer Privacy & Data Protection conference, Brussels
	\| <font color="#333333">[http://www.cpdpconferences.org/ http://www.cpdpconferences.org/]</~~font~~><br/>		\| <font color="#333333">[http://www.cpdpconferences.org/ http://www.cpdpconferences.org/]<br/></font>
	\|-		\|-
	\| October 23-26 2015		\| October 23-26 2015
	\| Amsterdam privacy conference		\| Amsterdam privacy conference
	\| [http://www.apc2015.net/ http://www.apc2015.net/]<br/>		\| <font color="#333333">[http://www.apc2015.net/ http://www.apc2015.net/]<br/></font>
	\|-		\|-
	\| October 7-8 2015		\| October 7-8 2015
	\| 3rd Annual Privacy Forum, Luxemburg		\| 3rd Annual Privacy Forum, Luxemburg
	\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]</~~font~~><br/>		\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]<br/></font>
	\|-		\|-
	\| August 31-September 1 2015		\| August 31-September 1 2015
	\| CCC Privacy-by-design workshop, Pittsburgh		\| CCC Privacy-by-design workshop, Pittsburgh
	\| <font color="#333333">[http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design]</~~font~~><br/>		\| <font color="#333333">[http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design]<br/></font>
	\|-		\|-
	\| July 8-9 2015		\| July 8-9 2015
Line 178:		Line 182:
	OASIS conference Ditton Manor UK <span style="line-height: 1.6;">(Building trust in a hyperconnected world)</span>		OASIS conference Ditton Manor UK <span style="line-height: 1.6;">(Building trust in a hyperconnected world)</span>

	\| <font color="#333333">[https://www.oasis-open.org/events/hyperconnected-2015 https://www.oasis-open.org/events/hyperconnected-2015]</~~font~~><br/>		\| <font color="#333333">[https://www.oasis-open.org/events/hyperconnected-2015 https://www.oasis-open.org/events/hyperconnected-2015]<br/></font>
	\|-		\|-
	\| June 5th 2015		\| June 5th 2015
	\| IPEN Workshop Leuven		\| IPEN Workshop Leuven
	\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015 https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015]</~~font~~><br/>		\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015 https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015]<br/></font>
	\|}		\|}

Antoniok at 15:45, 29 April 2016

2016-04-29T15:45:31Z

← Older revision		Revision as of 17:45, 29 April 2016
Line 156:		Line 156:
	\| May 2016		\| May 2016
	\| IEEE International Workshop on Privacy Engineering		\| IEEE International Workshop on Privacy Engineering
	\| ~~<font color="#333333">~~[http://ieee-security.org/TC/~~SPW2015~~/IWPE http://ieee-security.org/TC/~~SPW2015~~/IWPE]<br/~~></font~~>		\| [http://ieee-security.org/TC/SPW2016/IWPE/program.html http://ieee-security.org/TC/SPW2016/IWPE/program.html]<br/>
	\|-		\|-
	\| January 27-29 2016		\| January 27-29 2016
	\| 9th International conference, Computer Privacy & Data Protection conference, Brussels		\| 9th International conference, Computer Privacy & Data Protection conference, Brussels
	\| <font color="#333333">[http://www.cpdpconferences.org/ http://www.cpdpconferences.org/]<br/></~~font~~>		\| <font color="#333333">[http://www.cpdpconferences.org/ http://www.cpdpconferences.org/]</font><br/>
	\|-		\|-
	\| October 23-26 2015		\| October 23-26 2015
Line 168:		Line 168:
	\| October 7-8 2015		\| October 7-8 2015
	\| 3rd Annual Privacy Forum, Luxemburg		\| 3rd Annual Privacy Forum, Luxemburg
	\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]<br/></~~font~~>		\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]</font><br/>
	\|-		\|-
	\| August 31-September 1 2015		\| August 31-September 1 2015
	\| CCC Privacy-by-design workshop, Pittsburgh		\| CCC Privacy-by-design workshop, Pittsburgh
	\| <font color="#333333">[http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design]<br/></~~font~~>		\| <font color="#333333">[http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design]</font><br/>
	\|-		\|-
	\| July 8-9 2015		\| July 8-9 2015
Line 178:		Line 178:
	OASIS conference Ditton Manor UK <span style="line-height: 1.6;">(Building trust in a hyperconnected world)</span>		OASIS conference Ditton Manor UK <span style="line-height: 1.6;">(Building trust in a hyperconnected world)</span>

	\| <font color="#333333">[https://www.oasis-open.org/events/hyperconnected-2015 https://www.oasis-open.org/events/hyperconnected-2015]<br/></~~font~~>		\| <font color="#333333">[https://www.oasis-open.org/events/hyperconnected-2015 https://www.oasis-open.org/events/hyperconnected-2015]</font><br/>
	\|-		\|-
	\| June 5th 2015		\| June 5th 2015
	\| IPEN Workshop Leuven		\| IPEN Workshop Leuven
	\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015 https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015]<br/></~~font~~>		\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015 https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015]</font><br/>
	\|}		\|}

Antoniok at 04:32, 26 October 2015

2015-10-26T04:32:36Z

← Older revision		Revision as of 06:32, 26 October 2015
Line 156:		Line 156:
	\| May 2016		\| May 2016
	\| IEEE International Workshop on Privacy Engineering		\| IEEE International Workshop on Privacy Engineering
	\| [http://ieee-security.org/TC/SPW2015/IWPE http://ieee-security.org/TC/SPW2015/IWPE]<br/>		\| <font color="#333333">[http://ieee-security.org/TC/SPW2015/IWPE http://ieee-security.org/TC/SPW2015/IWPE]<br/></font>
	\|-		\|-
	\| January 27-29 2016		\| January 27-29 2016
	\| 9th International conference, Computer Privacy & Data Protection conference, Brussels		\| 9th International conference, Computer Privacy & Data Protection conference, Brussels
	\| <font color="#333333">[http://www.cpdpconferences.org/ http://www.cpdpconferences.org/]</font><br/>		\| <font color="#333333">[http://www.cpdpconferences.org/ http://www.cpdpconferences.org/]<br/></font>
			\|-
			\| October 23-26 2015
			\| Amsterdam privacy conference
			\| [http://www.apc2015.net/ http://www.apc2015.net/]<br/>
	\|-		\|-
	\| October 7-8 2015		\| October 7-8 2015
	\| 3rd Annual Privacy Forum, Luxemburg		\| 3rd Annual Privacy Forum, Luxemburg
	\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]</~~font~~><br/>		\| <font color="#333333">[http://privacyforum.eu/ http://privacyforum.eu/]<br/></font>
	\|-		\|-
	\| August 31-September 1 2015		\| August 31-September 1 2015
	\| CCC Privacy-by-design workshop, Pittsburgh		\| CCC Privacy-by-design workshop, Pittsburgh
	\| <font color="#333333">[http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design]</~~font~~><br/>		\| <font color="#333333">[http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design http://www.cra.org/ccc/visioning/visioning-activities/privacy-by-design]<br/></font>
	\|-		\|-
	\| July 8-9 2015		\| July 8-9 2015
Line 174:		Line 178:
	OASIS conference Ditton Manor UK <span style="line-height: 1.6;">(Building trust in a hyperconnected world)</span>		OASIS conference Ditton Manor UK <span style="line-height: 1.6;">(Building trust in a hyperconnected world)</span>

	\| <font color="#333333">[https://www.oasis-open.org/events/hyperconnected-2015 https://www.oasis-open.org/events/hyperconnected-2015]</~~font~~><br/>		\| <font color="#333333">[https://www.oasis-open.org/events/hyperconnected-2015 https://www.oasis-open.org/events/hyperconnected-2015]<br/></font>
	\|-		\|-
	\| June 5th 2015		\| June 5th 2015
	\| IPEN Workshop Leuven		\| IPEN Workshop Leuven
	\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015 https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015]</~~font~~><br/>		\| <font color="#333333">[https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015 https://secure.edps.europa.eu/EDPSWEB/edps/EDPS/IPEN/IPEN_Workshop_2015]<br/></font>
	\|}		\|}

Antoniok at 14:42, 11 August 2015

2015-08-11T14:42:31Z

← Older revision		Revision as of 16:42, 11 August 2015
Line 62:		Line 62:
	\| Context<br/>		\| Context<br/>
	\|		\|
	<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">The CNIL is the French Data Protection Authority (DPA).</span>		<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">The CNIL is the French Data Protection Authority (DPA).</span>

	<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">In June 2012, the CNIL published ~~another~~ guide on privacy risk management, applicable to complex processings or high risks scenarios. It helped data controllers to get an objective understanding of the risks arising from their processings, in order to select the necessary and sufficient security controls.</span>		<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">In June 2012, the CNIL published a guide on privacy risk management, applicable to complex processings or high risks scenarios. It helped data controllers to get an objective understanding of the risks arising from their processings, in order to select the necessary and sufficient security controls.</span>

	This guide was updated in July 2015 to remain in line with the European Data Protection Regulation project and the WP29’s work on the risk based approach. It also considers feedbacks and improvements proposed by different interested parties<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">~~made available~~ privacy impact assessments guidelines. Three documents are available</span>.		This guide was updated in July 2015 to remain in line with the European Data Protection Regulation project and the WP29’s work on the risk based approach. It also considers feedbacks and improvements proposed by different interested parties on<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify"> privacy impact assessments guidelines. Three documents are available</span>.

	\|-		\|-

MatthieuGrall: Corrections and further details

2015-07-23T15:57:57Z

Corrections and further details

← Older revision		Revision as of 17:57, 23 July 2015
Line 56:		Line 56:
	\|}		\|}

	=== <span style="font-size:larger;">CNIL ~~Privacy Risk analysis /~~ Privacy Impact Assessment</span> ===		=== <span style="font-size:larger">CNIL Privacy Impact Assessment</span> (PIA) Manual ===

	{\| ~~border~~="1" ~~cellspacing~~="1" cellpadding="1" ~~style~~="~~width: 900px;~~"		{\| style="width: 900px" border="1" cellpadding="1" cellspacing="1"
	\|-		\|-
	\| Context		\| Context<br/>
	\|		\|
	<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify;">CNIL is the French DPA.</span>		<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">The CNIL is the French Data Protection Authority (DPA).</span>

	<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify;">In June 2012, the CNIL published another guide on privacy risk management, applicable to complex processings or high risks scenarios. It helped data controllers to get an objective understanding of the risks arising from their processings, in order to select the necessary and sufficient security controls.</span>		<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">In June 2012, the CNIL published another guide on privacy risk management, applicable to complex processings or high risks scenarios. It helped data controllers to get an objective understanding of the risks arising from their processings, in order to select the necessary and sufficient security controls.</span>

	This guide was updated in July 2015 to remain in line with the European Data Protection Regulation project and the WP29’s work on the risk based approach. It also considers feedbacks and improvements proposed by different interested parties<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify;">made available privacy impact assessments guidelines. Three documents are available</span>		This guide was updated in July 2015 to remain in line with the European Data Protection Regulation project and the WP29’s work on the risk based approach. It also considers feedbacks and improvements proposed by different interested parties<span style="color: rgb(44, 44, 40); font-family: Arial, Helvetica, sans-serif; font-size: 12.996000289917px; line-height: normal; text-align: justify">made available privacy impact assessments guidelines. Three documents are available</span>.

	\|-		\|-
	\| URL		\| URL
	\| English web page:[http://www.cnil.fr/english/news-and-events/news/article/privacy-impact-assessments-the-cnil-publishes-its-pia-manual/ http://www.cnil.fr/english/news-and-events/news/article/privacy-impact-assessments-the-cnil-publishes-its-pia-manual/]		\| English web page:[http://www.cnil.fr/english/news-and-events/news/article/privacy-impact-assessments-the-cnil-publishes-its-pia-manual/ http://www.cnil.fr/english/news-and-events/news/article/privacy-impact-assessments-the-cnil-publishes-its-pia-manual/] <br/>
	\|-		\|-
	\| Documents		\| Documents
	\|		\|
	Methodology; [http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-1-Methodology-EN.pdf http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-1-Methodology-EN.pdf]		Methodology: [http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-1-Methodology-EN.pdf http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-1-Methodology-EN.pdf]

	~~Templates~~: [http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-2-Tools-EN.pdf http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-2-Tools-EN.pdf]		Tools (templates and knowledge bases): [http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-2-Tools-EN.pdf http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-2-Tools-EN.pdf]

	Good practices: [http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-3-GoodPractices.pdf http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-3-GoodPractices.pdf]		Good practices: [http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-3-GoodPractices.pdf http://www.cnil.fr/fileadmin/documents/en/CNIL-PIA-3-GoodPractices.pdf]

	\|-		\|-
	\| Comments		\| Comments<br/>
	\|		\|
	[Antonio Kung]		[Antonio Kung]

	*~~inspired from~~ EBIOS ~~security~~ risk ~~analysis~~.		*It describes how to use the EBIOS method in the specific context of “Personal Data protection”. EBIOS – ''Expression des Besoins et Identification des Objectifs de Sécurité'' (Expression of Needs and Identification of Security Objectives) – is the name of the risk management method published by the Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI, the French National Cybersecurity Agency).

			[Matthieu Grall]

			*The PIA rests on two pillars:<br/>1. fundamental principles and rights, which are “non-negotiable”, established by law and which must be respected and cannot be subject to any variation, regardless of the nature, severity and likelihood of risks;<br/>2. management of data subjects’ privacy risks, which determines the appropriate technical and organizational controls to protect personal data.

	\|}		\|}

Antoniok at 10:48, 17 July 2015

2015-07-17T10:48:53Z

← Older revision		Revision as of 12:48, 17 July 2015
Line 119:		Line 119:

	*defines 3 privacy engineering objectives (predictability, manageability, dissociability)		*defines 3 privacy engineering objectives (predictability, manageability, dissociability)
	*focuses on organisational ~~risks~~ (e.g. reputation). ~~Does~~ not ~~focus at this point~~ on ~~risks for citizens ~~		*includes an impact factor which focuses on organisational aspects (e.g. reputation). Impact on citizen (e.g. stigmatization) are not included in the privacy risk equation (likelihood x impact) but they have an influence on the organisational impact

	\|}		\|}